Monday, May 13, 2013

New Setup package avoids bug when monitoring multiple interfaces

A new Setup package is now available that avoids a bug when monitoring multiple interfaces. When you choose Advanced Setup, the Bro CPU Cores screen will still ask you how many CPU cores you'd like to use for Bro, but it now also includes the following note:
Please note there is a bug in Bro 2.1 when monitoring multiple interfaces with PF_RING that results in traffic loss. If you're monitoring multiple interfaces, we'll configure Bro to disable PF_RING load balancing to avoid this issue. We'll record your desired number of PF_RING CPU cores for when Bro 2.2 is released.
This resolves the following issue:
Issue 317: Setup should disable Bro's PF_RING load balancing config when monitoring multiple NICs

The new package has been tested by Matt Gregory.  Thanks, Matt!

If you're performing a new installation, it's important to update your packages right after you've completed the Ubuntu installer and BEFORE running Setup.  You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:
sudo apt-get update && sudo apt-get dist-upgrade

If you have any questions or problems, please use our mailing list:

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

No comments:

Search This Blog

Featured Post

Sneak Peek: New Detections Feature coming in Security Onion 2.4.70!

Our latest video is a sneak peek at a NEW feature coming to our FREE and OPEN Security Onion platform in the upcoming 2.4.70 release! This n...

Popular Posts

Blog Archive